How to Spot a Scam Text or Email Before You Click

Scam messages have gotten good. The days of obvious spelling mistakes and a foreign prince are mostly behind us. Today's version looks like a delivery notice, a bank alert, or a message from your own boss, and it arrives at a moment when any of those would be plausible.

That plausibility is the whole trick. Here is what to look for, and what to do when something slips past you.

Every scam needs you to hurry

Almost all of them share one feature: a reason to act right now. Your package could not be delivered. Your account will be closed. A payment failed. Someone tried to log in.

Urgency exists to stop you thinking. A real bank does not close your account in four hours over an unread email, and a real delivery company does not need a small fee to release your parcel. When a message makes your stomach drop, that reaction is the product, not a coincidence.

Slow down. Almost nothing genuine gets worse because you waited ten minutes to check.

The five signals worth checking

You were not expecting it. A delivery notice for a package you did not order. A tax refund you never applied for. Unexpected plus urgent is the most common combination there is.

The sender address does not match the brand. The display name can say anything. Tap it to see the actual address behind it. Real companies send from their own domain, not from a free mail service or a domain with extra words bolted on.

The link goes somewhere else. The text of a link and its destination are two different things. On a computer, hover over it and read the address that appears at the bottom of the screen. On a phone, press and hold until a preview appears rather than tapping.

It asks for something a real company would not. Passwords, verification codes, card numbers, or payment by gift card, wire transfer, or cryptocurrency. Legitimate businesses do not ask for a one-time code, and no genuine refund requires you to buy gift cards.

Something in the language is slightly off. Not always errors — often just a tone that does not fit. A greeting that uses your email address instead of your name. A formality that seems misplaced. Modern scams are well written, so trust the feeling of oddness even when you cannot point at a mistake.

What scammers imitate most

• Delivery companies — a missed parcel and a small redelivery fee
• Banks — suspicious activity, verify your account immediately
• Tax authorities — a refund waiting, or an unexpected penalty
• Streaming and subscription services — your payment failed, update your card
• Your boss or a colleague — a quick favor, usually involving a purchase, usually while they are "in a meeting"
• Family members — a new number, an urgent problem, please send money

The last two are worth extra caution because they use a relationship rather than a brand. If a message from someone you know asks for money or gift cards, call the number you already have for that person before doing anything.

The one habit that beats all of this

Never use the link in the message. Go to the company yourself.

Open your banking app the normal way. Type the delivery company's address into your browser. Call the number printed on the back of your card, not the number in the email. If the message was genuine, whatever it describes will be waiting for you when you arrive through the front door.

This single habit defeats nearly every phishing attempt, because the whole scheme depends on you following their link to their page.

If you already clicked

Clicking a link alone is often harmless. Entering information is where the damage happens. Either way, act quickly rather than hoping.

1. If you entered a password, change it immediately on the real site — and change it anywhere else you used the same one.
2. If you entered card details, call your bank and have the card frozen or replaced.
3. If you shared a verification code, contact the company directly; that code was almost certainly the last thing standing between someone and your account.
4. Turn on two-factor authentication for your email first, then your bank and main shopping accounts.
5. Watch your statements for a few weeks. Small test charges often come before large ones.

Then report it. Forward suspicious emails to your provider's phishing address, report scam texts through your phone's built-in reporting option, and tell the imitated company — they usually have a page for exactly this.

A note on embarrassment

People fall for these constantly, including careful ones, because the messages are designed by professionals and arrive on the day you actually are expecting a parcel. The delay caused by feeling foolish does more damage than the click did.

If it happens, deal with it the same way you would a lost wallet: cancel, change, move on.